Skip to content

0.1.20

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Jul 04:59
· 2 commits to main since this release
0.1.20
6316e3f

Central Vault Sync 0.1.20

Release-provenance tag correction for the Obsidian Community scanner.

  • Publishes from a lightweight Git tag so the GitHub tag ref points directly to the same commit digest recorded in SLSA provenance.
  • Release CI now fails closed if a future release tag is annotated.
  • Retains 0.1.19's unique asset digests and one single-subject provenance statement per main.js, manifest.json, and styles.css.
  • Retains the 0.1.17 stale-parent bootstrap fix and all 0.1.16 performance/progress behavior unchanged.

Earlier review releases used annotated tags. GitHub CLI dereferenced those tags and verified the artifact statements, but third-party SLSA verifiers can compare the tag-object digest with the provenance commit digest and reject them. This release removes that ambiguity.

Verification: lint, typecheck, 31 tests, production build, policy checks, lightweight-tag API type, exact release/source bytes, unique digests, one subject per statement, and strict GitHub SLSA verification.

Assets 5
Loading